Security update for ibus (important)

openSUSE Security Update: Security update for ibus Announcement ID: openSUSE-SU-2019:2174-1 Rating: important References: 1150011 Cross-References: CVE-2019-14822 Affected Products: openSUSE Leap 15.0 An update that fixes one vulnerability is now available. Description: This update for ibus fixes...

SUSE SLED15 / SLES15 Security Update : ibus (SUSE-SU-2019:2427-1)

This update for ibus fixes the following issues : CVE-2019-14822: Fixed misconfiguration of the DBus server allows to unprivileged user could monitor and send method calls to the ibus bus of another user bsc1150011. Note that Tenable Network Security has extracted the preceding description block...

Updated ibus packages fix security vulnerability

It was discovered that any unprivileged user could monitor and send method calls to the ibus bus of another user, due to a misconfiguration during the setup of the DBus server. When ibus is in use, a local attacker, who discovers the UNIX socket used by another user connected on a graphical...

Debian DSA-4525-1 : ibus - security update

Simon McVittie reported a flaw in ibus, the Intelligent Input Bus. Due to a misconfiguration during the setup of the DBus, any unprivileged user could monitor and send method calls to the ibus bus of another user, if able to discover the UNIX socket used by another user connected on a graphical...

Debian: Security Advisory (DSA-4525-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Microsoft Windows Internet Settings Security Feature Bypass Vulnerability

Microsoft Windows suffers from an Internet Settings misconfiguration security feature bypass vulnerability. Versions affected include Windows 7 SP1, 8.0, 8.1 x86 and x64 with full patches up to July 2019. Exploit Title: Microsoft Windows 'Internet Settings' Misconfiguration Security Feature Bypas...

SUSE SLES12 Security Update : ibus (SUSE-SU-2019:2388-1)

This update for ibus fixes the following issues : Security issue fixed : CVE-2019-14822: Fixed a misconfiguration of the DBus server that allowed an unprivileged user to monitor and send method calls to the ibus bus of another user. bsc1150011 Note that Tenable Network Security has extracted the...

SUSE SLED12 / SLES12 Security Update : ibus (SUSE-SU-2019:2389-1)

This update for ibus fixes the following issues : Security issue fixed : CVE-2019-14822: Fixed a misconfiguration of the DBus server that allowed an unprivileged user to monitor and send method calls to the ibus bus of another user. bsc1150011 Note that Tenable Network Security has extracted the...

SUSE SLED15 / SLES15 Security Update : ibus (SUSE-SU-2019:2387-1)

This update for ibus fixes the following issues : Security issue fixed : CVE-2019-14822: Fixed a misconfiguration of the DBus server that allowed an unprivileged user to monitor and send method calls to the ibus bus of another user. bsc1150011 Note that Tenable Network Security has extracted the...

Cisco Extends Patch for IPv6 DoS Vulnerability

Cisco has extended its patch for a high-severity IPv6 denial-of-service DoS vulnerability that was first addressed in 2016. The bug CVE-2016-1409 is a vulnerability in the IPv6 packet processing functions of multiple Cisco products, which could allow an unauthenticated, remote attacker to cause a...

Microsoft Windows Internet Settings Security Feature Bypass

Exploit Title: Microsoft Windows 'Internet Settings' Misconfiguration Security Feature Bypass Vulnerability Google Dork: N/A Date: September, 17 2019 Exploit Author: Eduardo Braun Prado Vendor Homepage: http://www.microsoft.com/ Software Link: http://www.microsoft.com/ Version: Windows 7 SP1, 8.0...

ibus defect vulnerability

ibus is an input framework for Linux/Unix platforms. A security vulnerability exists in ibus, which stems from a failure to configure the Dbus server settings correctly. A local attacker could use this vulnerability to intercept all keystrokes of an affected user, modify the input method engine, ...

CVE-2019-13140

Inteno EG200 EG200-WU7P1UADAMO3.16.4-1902261650 routers have a JUCI ACL misconfiguration that allows the "user" account to extract the 3DES key via JSON commands to ubus. The 3DES key is used to decrypt the provisioning file provided by Adamo Telecom on a public URL via cleartext HTTP...

Design/Logic Flaw

Inteno EG200 EG200-WU7P1UADAMO3.16.4-1902261650 routers have a JUCI ACL misconfiguration that allows the "user" account to extract the 3DES key via JSON commands to ubus. The 3DES key is used to decrypt the provisioning file provided by Adamo Telecom on a public URL via cleartext HTTP...

CVE-2019-13140

Inteno EG200 EG200-WU7P1UADAMO3.16.4-1902261650 routers have a JUCI ACL misconfiguration that allows the "user" account to extract the 3DES key via JSON commands to ubus. The 3DES key is used to decrypt the provisioning file provided by Adamo Telecom on a public URL via cleartext HTTP...

CVE-2019-13140

Inteno EG200 EG200-WU7P1UADAMO3.16.4-1902261650 routers have a JUCI ACL misconfiguration that allows the "user" account to extract the 3DES key via JSON commands to ubus. The 3DES key is used to decrypt the provisioning file provided by Adamo Telecom on a public URL via cleartext HTTP...

CVE-2019-13140

CVE-2019-13140 affects Inteno EG200 series (EG200-WU7P1U_ADAMO3.16.4-190226_1650 and older). A JUCI ACL misconfiguration allows the non‑privileged user to extract the 3DES key via ubus JSON commands, enabling decryption of the provisioning file provided by Adamo Telecom from a public HTTP URL. Im...

Inteno IOPSYS Gateway - Improper Access Restrictions

Inteno IOPSYS Gateway - Improper Access Restrictions Exploit Title: Inteno IOPSYS Gateway 3DES Key Extraction - Improper Access Restrictions Date: 2019-06-29 Exploit Author: Gerard Fuguet [email protected] Vendor Homepage: https://www.intenogroup.com/ Version: EG200-WU7P1UADAMO3.16.4-1902261650...

Inteno IOPSYS Gateway - Improper Access Restrictions

Exploit Title: Inteno IOPSYS Gateway 3DES Key Extraction - Improper Access Restrictions Date: 2019-06-29 Exploit Author: Gerard Fuguet [email protected] Vendor Homepage: https://www.intenogroup.com/ Version: EG200-WU7P1UADAMO3.16.4-1902261650 Fixed Version: EG200-WU7P1UADAMO3.16.8-1908200937...

Information Disclosure

airbrake-ruby is vulnerable to information disclosure. A misconfiguration where the NoticeNotifier is initialized without blacklist/whitelist keys being specified in Config, causes a filter on the password to stop taking effect and exposing the password in plaintext...